Update problem - builtin\users?!?

[actech]

I'm having problems with getting my new 2008r2 server to do Windows Updates. It fails with the error 8000ffff. The best I can find on Google is that it is a permissions error and I need to have the builtin\users with read access to the system drive. I do vaguely recall removing this for security reasons when I first set the server up.

 

Know I know you can use xcacls to fix this but I am unsure as to the syntax or even if this is the best idea. Does anyone have any suggestions or help with using xcacls?

 

Cheers Rowan.